Re: [TLS] PR#1091: Changes to provide middlebox robustness

[Yoav Nir <[e-mail]>]

> On 8 Nov 2017, at 2:32, Salz, Rich <[e-mail]> wrote:
> 
> ➢ Given that we're almost there, and that only really browsers are
>     asking for these hacks, and that even some of those were almost ready
>     to ship without these hacks, I don't think that this is entirely
>     unrealistic as an aspiration.
> 
> The Internet is more than just a couple of browser executables.
> 
> Does nobody think of the servers?
>  
> I do, but I don't really see how they're relevant for this question. Don't the servers control the middleboxes they are behind?
>  
> The smiley got lost.  But smiley isn’t quite the right emoticon either. 

Maybe we need a resigned to the harsh reality emoticon. Oh wait, there is one [1]

> But to answer your question: no, the often don’t.  And it’s not just the middleboxes they are behind, but all those along the way.

The server-side middleboxes tend to be somewhat higher quality and get more regular updates. There are also fewer vendors, so the problem is more manageable.

>  
> To say that only browsers were asking for these hacks is also a little disingenuous.  It was a self-selected design group (to be charitable) that mostly worked by themselves without the whole WG being involved.  I’m glad we seem to be ending up with something that works, with the only thing being lost is some nerd esthetics, but let’s not forget the (to me, disappointing) way the whole thing went down: a collaboration among, and only among, Google, Mozilla, and Facebook.

Sure. Whatever applies to browsers applies to every app or library that uses a web service. So wget, cURL, any of the libraries for Java, whatever you call the libraries behind apps on the various mobile platforms. 

Yoav 

[1] https://www.urbandictionary.com/define.php?term=%F0%9F%98%8C